Falhas do tipo CWE-79

30.218 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando a aplicação insere dados não validados do usuário diretamente em páginas HTML enviadas ao navegador, permitindo que atacantes injetem código JavaScript malicioso. O navegador executa esse script com os mesmos privilégios da sessão legítima, comprometendo dados da vítima ou sua conta.

Exemplo

Um formulário de busca que exibe o termo digitado na página sem sanitização: se você buscar por '<script>alert(1)</script>', esse script será executado no navegador de quem abrir o resultado. Um atacante pode roubar cookies de sessão ou redirecionar para um site falso.

Como mitigar

Valide e escape todos os dados do usuário antes de renderizar em HTML (use funções nativas como textContent em vez de innerHTML). Para entrada de dados, liste o que é permitido (whitelist); para saída, contextualize o escape (HTML, JavaScript, URL). Use Content Security Policy (CSP) como camada adicional para restringir execução de scripts inline.

CVE-2025-30548HIGHWordPress Advanced Post Search plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-53796MEDIUMWordPress Themesflat Addons For Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-22310MEDIUMWordPress Formzu WP Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-25920MEDIUMWordPress WP SMS plugin <= 6.3.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-30544HIGHWordPress OK Poster Group plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-2715MEDIUMtimschofield webERP Confirm Dispatch and Invoice Page ConfirmDispatch_Invoice.php cross site scriptingEPSS 0.3%CVE-2024-3851MEDIUMUnrestricted File Upload Leading to XSS in imartinez/privategptEPSS 0.3%CVE-2025-30869HIGHWordPress Image Wall plugin <= 3.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.3%CVE-2026-119764HIGHMythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File PreviewEPSS 0.3%CVE-2026-23839CRITICALMovary vulnerable to Cross-site Scripting with `?categoryUpdated=` paramEPSS 0.3%CVE-2024-32456MEDIUMWordPress Envo Extra plugin <= 1.8.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-9823MEDIUMReflected XSS in lead:addLeadTags - Quick AddEPSS 0.3%CVE-2026-3702MEDIUMSourceCodester Loan Management System index.php cross site scriptingEPSS 0.3%CVE-2026-3763MEDIUMcode-projects Simple Flight Ticket Booking System showhistory.php cross site scriptingEPSS 0.3%CVE-2024-38674MEDIUMWordPress SKT Addons for Elementor plugin <= 3.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-22150MEDIUMWordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2024-9864MEDIUMEventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-11900MEDIUMPortfolio – Filterable Masonry Portfolio Gallery for Professionals <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-9375MEDIUMWordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site ScriptingEPSS 0.3%CVE-2026-107098MEDIUMRoyal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height SettingEPSS 0.3%